Either bankrupt the company (fine is 20% of yearly revenue) or jail the executives and everyone responsible.

These aren't human beings. These are corporations: inanimate, unfeeling entities worth billions of dollars whose only point in existing is making money at your personal expense. They should think 10 times before engaging in any destructive behavior such as "leaking" patient data to advertising companies. If they're not afraid, then the fines aren't high enough and must be increased.

Of course we’re finding out repeatedly that no threatening fines don’t prevent that behavior either. :/ there’s a theoretical fine line where just enough fines will prevent such behavior but frankly I’m having a harder and harder time believing such rhetoric.

Maybe it’s the ownership of such companies that are wrong. I highly doubt Cerebral would’ve made this decision in the first place if it was owned by regular people, especially regular mental health professionals.

The greedy will just find ways to hide their greed.

In Burundi you'll probably just be captured and murdered.

The USA has very high recitivism when we throw ex convicts out on the streets homeless and broke, which is not a punishment, it's just piss-poor social management.

Norway has one of the lowestest recitivism rates in the world. They combine just punishments with actual correctional assistance for reintegration into society.

Punishments with real correctional assistance and social resources is a proven successful combination.

An uncle of an ex-girlfriend was put in jail for a MITM scheme in the construction bussiness. He was active for about 2 years until they got him. When I heard an estimate of how much he made, I went ahead and did the 24/7 hourly rate calculation for his jailtime. It was a 3 digit figure.

“The Nixon Campaign in 1968, and the Nixon White House after that, had two enemies: the antiwar Left, and Black people. You understand what I’m saying? We knew we couldn’t make it illegal to be either against the war or Black. But by getting the public to associate the hippies with marijuana and Blacks with heroin, and then criminalizing both heavily, we could disrupt those communities. We could arrest their leaders, raid their homes, break up their meetings and vilify them night after night on the evening news. Did we know we were lying about the drugs? Of course we did.” - Lee Atwater

The veracity of the quote has been questioned by Ehrlichman's family, while Vox senior correspondent German Lopez has suggested that Ehrlichman was either wrong or lying. According to Lopez:

    But Ehrlichman's claim is likely an oversimplification, according to historians who have studied the period and Nixon's drug policies in particular. There's no doubt Nixon was racist, and historians told me that race could have played one role in Nixon's drug war. But there are also signs that Nixon wasn't solely motivated by politics or race: For one, he personally despised drugs – to the point that it's not surprising he would want to rid the world of them. And there's evidence that Ehrlichman felt bitter and betrayed by Nixon after he spent time in prison over the Watergate scandal, so he may have lied.

    More importantly, Nixon's drug policies did not focus on the kind of criminalization that Ehrlichman described. Instead, Nixon's drug war was largely a public health crusade – one that would be reshaped into the modern, punitive drug war we know today by later administrations, particularly President Ronald Reagan...

    "It's certainly true that Nixon didn't like blacks and didn't like hippies," Courtwright said. "But to assign his entire drug policy to his dislike of these two groups is just ridiculous."*

And this one deserves (in my opinion) to be punished more harshly than other things which today are already punished (you mention selling drugs, which is way better morally). The amount of people damaged by this privacy infringement is quite high.

Are people who attempted to opt out of online tracking, but got tracked anyway[0] victims? That's probably less severe than this case where a company sold health information, but it's definitely illegal in the EU and likely at least a deceptive business practice in other jurisdictions.

Are people who buy drugs and harm themselves by overdosing or spending all their time intoxicated victims? If the person is an adult and the drug is alcohol, that's not even illegal most places.

Are victims of secondary crimes victims of the illegal drug trade, of drug prohibition itself, or simply of the secondary crime? One could easily make a case for any of those.

[0] https://www.theregister.com/2023/03/03/online_privacy_tracki...

True, a lot of people are victims of their own stupid decisions. A society should still try reduce the likelihood of the stupid decisions, especially when there are obvious bad actors actively trying to increase such likelihood.

That's an interesting question whether it's fair to treat it this way. I can see valid arguments on both sides.

Also the people affected by this incident alone number in the millions.

With mental health data being at stake here, the amount of victims under this definition could also very well be non-zero.

Anyway there are a lot of crimes, that don't produce those kind of victims. If I mug someone and don't kill them or destroy their life in the process, have I not commited a crime?

The privacy infringement here is an obvious damage to the dignity of everyone affected. Wouldn't you feel victimized if I listened in on you speaking with your doctor, wrote everything down, stamped your name, address, and date of birth on it and started giving out copies of the resulting paper to random people? Which is exactly whats happening here, except my example is more harmless by a factor of a few million people and has a lot fewer data points.

I would. I would also feel victimized if you mugged me (without killing me or hurting me physically). The question we are debating here is - should you be punished equally harshly in this two scenarios? I'm leaning towards "no". If you disagree I would like to understand your reasoning.

A doctor who reveals some information on one of their patients should be treated less harshly then a mugger of one person.

A mugger who robs ten people should be treated more harshly than a mugger who robs one person.

A doctor/company who reveals thousands of patients' information can reasonably treated more harshly than a mugger of ten people, because the absolute negative impact may be greater.

No ones life is directly injured because of a data leak. It's just data, it is entirely inert on it's own. Their life is injured entirely because of what third parties do with that data.

If data leaked and there were no bad actors in the world, there would be zero harm.

Note this is not the same as being against punishing illegal sale of private data.

Absolutely. It is 100% worse than selling drugs to willing buyers. How is this even a question?

Of course we do. We, as a society, have decided that murder is a more serious offense, and assigned a punishment for each accordingly. This process has to be repeated every time a new type of crime emerges.

A breach of one's personal data is clearly less severe than a violent attack upon one's person. But the former could enable the latter (eg if information were purchased by a stalker). And it certainly increases the base level of risk from fraud and adversarial commercial contact (secretly exploiting knowledge of a target to manipulate them into a purchase/sale decision).

Now scale the individual loss up by huge numbers of people, and consider what incentives led to the information security failure. While it's sometimes practical to remediate individual losses of privacy, at scale future injuries are virtually assured. It seems to me that this warrants an application of strict liability principles.

As for restitution, in ym view not only should injured parties be compensated in cash (and much more of it), but they should also be granted, individually or by proxy, partial ownership of the offending firm; that is, existing investors should have the value of their asset significantly diluted. The loss of personal security should be reflected in a loss of financial security to the asset holders.

Directly punish executives, upper management, board members and large shareholders when their companies break the law rather than just fining the company. This could include fines, prohibitions from holding similar positions, and jail time.

Stop commoditizing ownership by prohibiting ownership of companies by non-participants. This last one would have the largest impact but is the least likely.